[Issue 9835] LDAP aliases ought to always be dereferenced